1. Controller and contact
The controller is VSpot’s legal owner. Use the address at the end for privacy requests, rights and complaints. Before final commercial publication, the app must also display the owner’s name or company name, tax identification number and address required by applicable law.
2. Data we process
We process account and login data, declared age, language, profile, biography, social links you provide, photos, content, campaigns, Experiences, applications, bookings, chats, submissions, reviews, reports, support and preferences. We also process device identifiers, IP address, security and crash logs, notifications and usage data. Verification documents and selfies, when requested, are stored with restricted access.
3. Visibility and sharing between users
Information marked public, including profile image, display name, biography, reviews and social links, may be visible and clickable to other users. Parties to an application or booking receive the information needed to assess and manage it. An Experience’s exact address is normally limited to the organizer and accepted participants. Do not publish unnecessary sensitive data.
4. Location and check-in
With device permission we use precise or approximate location to show nearby content, place an activity and verify check-in. We may record coordinates, accuracy, time, booking, result and QR evidence for security and claims. Organizers and brands provide addresses; we do not guarantee their accuracy. You can withdraw system permission, but location-dependent features will stop working.
5. Payments and financial data
The payment provider, currently Stripe, processes cards, bank accounts, financial identity and transfers under its own policy. VSpot receives and keeps customer, account, payment, refund and transfer identifiers, amounts, currency, breakdown, status and necessary anti-fraud signals. We do not store full card or bank-account numbers. Where cash is available, we record declared payment, refund or dispute confirmations.
6. Purposes and legal bases
We process data to create and manage accounts; display profiles and offers; manage applications, bookings, chats, payments, refunds, settlements and support; perform the contract; comply with accounting, tax, consumer and legal duties; prevent fraud and protect users based on legitimate interests; and defend claims. Device location, personalized advertising and optional communications rely on consent where required. You may object to legitimate-interest processing based on your circumstances.
7. Providers, recipients and transfers
We do not sell personal data. Necessary data is disclosed to infrastructure, hosting and storage providers; Firebase and Google Cloud; Google or Apple sign-in when selected; Stripe for payments; email, notification, mapping, diagnostics and support services; and AdMob or other advertising providers according to consent. Some providers may process data outside the EEA using adequacy decisions, standard contractual clauses or other valid safeguards. Data is also disclosed to authorities when legally required.
8. Advertising and consent
Where required, advertising preferences are requested through a compatible consent-management platform. You can change or withdraw consent through available options or applicable settings. Withdrawal does not affect prior processing and may result in non-personalized ads. Advertising identifiers are used only according to your preferences and device permissions.
9. Moderation, security and decisions
Reports may contain a restricted copy of reported content or conversation, party identities, reason, notes, actions and evidence. Rules and automated signals help rank results, detect abuse, duplicates or fraud and support moderation; significant sanctions may be reviewed by a person. We do not make solely automated decisions producing significant legal effects without required safeguards.
10. Retention
We retain data while the account is active and afterwards only as needed. Contract, payment, tax, fraud and claim records are kept for applicable legal periods. Restricted moderation files may retain reasons, evidence and reviewed messages for up to 24 months after closure, or longer for an investigation, legal duty or claim. Account deletion removes or anonymizes profile and content where possible without deleting records we must retain or third-party rights.
11. Your rights and complaints
You may request access, correction, deletion, restriction, objection and portability, withdraw consent and avoid solely automated decisions where applicable. You can delete the account in Settings when no obligation is pending or write to the contact below. We may request reasonable identity verification. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.
12. Security, children and changes
We use access controls, encrypted communications and protected storage, but no system eliminates all risk. Report unauthorized access. Children under 16 must not create an account. Material changes will be notified and renewed acceptance requested where required.
Privacy and rights contact: contact.desapli@gmail.com